Skip to main content
KŌJŌ Stack logo
KŌJŌ Stack
The First-Mile Industrial Data Plane

The First-Mile Industrial Data Plane

An industrial data plane is the layer where data from physical systems is acquired, structured, and prepared before it reaches any downstream system. This layer does not exist in traditional industrial architectures. KŌJŌ Stack establishes it at the first mile.

System Overview

One stack, from sensor to cloud

Industrial data moves across four secured zones-OT, the customer DMZ, your cloud, and the KŌJŌ Stack control plane. Every hop is authenticated and every connection is initiated from the inside out.

KŌJŌ Stack
KŌJŌ Stack
The first-mile industrial data plane
System Architecture
Own the first mile. Control the data.
One stack moves industrial data across four secured zones, from sensor to cloud. Every hop is authenticated, and every connection is initiated from the inside out.
Direct egress · optionalS3 · cloud MQTT · historian
OT
Operational technology · the plant floor
Industrial Equipment
PLCs, sensors, SCADA & historians, spoken to natively.
Edge Runtime
Ingests, transforms & buffers first-mile data, offline-safe.
CEL + UNS transformsRBE filteringStore & forward
Observability
Live metrics, module health & performance.
Managed Workloads
Brokers, protocol drivers & sidecars run as managed containers.
Zero-Touch Provisioning
ZTP enrolls each device with a signed identity, no manual setup.
Runs anywhere
InstallerDockerKubernetes
Reaches only the DMZ
First-mile
data
mTLS · outbound
Customer DMZ
On-prem security buffer · dials out only
License Server
Grants runtime leases on-site; entitlements never leave.
Message Broker
Telemetry, entitlements, and staged data (MQTT, Kafka) bridged upward.
Registry Mirror
Caches signed runtime images one hop from the edge.
MCP Server
Authenticated, read-only access for AI agents.
Destination Services
DMZ-hosted Kafka & MQTT where edge data can land on-site.
Bridge Runtime
A second KŌJŌ runtime relays staged streams to the cloud, e.g. MQTT to S3.
Initiates every outbound link
Bridged data
+ control
outbound only
Cloud
Your enterprise & cloud systems, where structured data lands
Direct or DMZ-bridged
Data Lakehouse
Open-table storage for analytics at scale.
Historian
Long-term process history & trends.
Streaming & Events
Real-time fan-out to downstream apps.
AI & Analytics
Models & dashboards on trusted data.
KŌJŌ Stack
Managed control plane that provisions & licenses the fleet
Vendor-managed
Admin Console
Customers, sites & entitlement issuance.
Fleet Console
Device provisioning & fleet operations.
Partner Portal
Partner onboarding & deployments.
Image & Broker Cloud
Signed image registry & cloud broker.
OT is isolated
The edge reaches only the DMZ, never the open internet.
Encrypted on every hop
Mutual TLS authenticates both ends of every link.
Connections dial outward
Lower zones initiate; the cloud never dials in.
KŌJŌ Stack
One stack. One trust root. From the sensor to the cloud.

The Data Boundary

Industrial data architectures are divided into two domains

On one side: operational systems-PLCs, sensors, SCADA, and historians. These generate raw, protocol-bound data at high frequency, with no inherent structure beyond device-level addressing.

On the other: enterprise and cloud systems-analytics platforms, AI/ML pipelines, data lakes, and business applications. These require structured, contextualized, reliable data to function.

KŌJŌ Stack is the data boundary between them. It is the layer where data is acquired, structured, filtered, and routed-where raw telemetry becomes usable. This is the industrial data plane. Without it, every downstream system must independently reconstruct data from raw, protocol-bound sources.

The architectural position

OT Domain

PLCs · Sensors · SCADA · Historians

Raw, protocol-bound, unstructured

Data Boundary

KŌJŌ Stack - First-Mile Data Plane

Ingest · Structure · Condition · Route

IT / Cloud Domain

Analytics · AI/ML · Data Lakes · Apps

Structured, contextualized, reliable

Left Side of the Boundary

OT Systems: Where Data Originates

Industrial data originates at PLCs, sensors, SCADA systems, and historians-each speaking different protocols with different timing models, data formats, and addressing schemes. Data here is raw, unstructured, and protocol-bound.

OPC UA

Subscriptions, Browse, security policies

OPC DA

Legacy SCADA / DCS, quality code preservation

Modbus TCP/RTU

Register polling, coils, discrete inputs

Siemens S7

Native protocol, no OPC server required

BACnet IP

COV subscriptions, polling modes

EtherNet/IP (CIP)

Allen-Bradley, Rockwell ecosystems

Sparkplug B

100% spec-compliant MQTT industrial standard

DNP3

Utility SCADA, polling + unsolicited modes

MQTT / Kafka

Broker ingress, topic filtering

The problem: each protocol has its own transport, timing model, data representation, and addressing. Without a structuring layer, every downstream system must independently solve protocol translation, context mapping, and reliability-leading to fragmented, inconsistent, and brittle architectures.

The Data Plane

KŌJŌ Stack: Where Data Becomes Usable

The industrial data plane is where raw telemetry becomes structured, contextualized, and reliable. KŌJŌ Stack owns twelve responsibilities that define what data exists downstream and how it behaves. Every responsibility executes at the edge, with deterministic behavior and bounded latency.

Downstream systems do not define data structures-KŌJŌ Stack does.

  • Data is acquired here-protocol-native ingestion at deterministic intervals
  • Data is structured here-ISA-95 namespace, canonical schema, provenance metadata
  • Data is contextualized here-identity, timestamp, quality, and source context
  • Data is prepared here-filtered, normalized, and routed for downstream consumption

This is the layer where industrial data becomes usable.

A

Data Acquisition

Protocol-native ingestion at deterministic intervals or server-push subscriptions. Each adapter speaks the native language of the device-no translation gateways. Timestamps, quality indicators, and device metadata are preserved at the point of origin.

B

Data Transformation

Normalization, scaling, unit conversion, and enrichment using the CEL expression engine. Report-by-Exception (RBE) deadband filtering reduces data volume by 90%+ while preserving all meaningful state transitions. Transforms are pure functions-same input, same output, always.

C

Contextualization

Every data point is mapped into an ISA-95 compliant Unified Namespace hierarchy: Enterprise → Site → Area → Line → Cell. Tags carry identity, timestamp, quality, and source context. The namespace is the contract between all producers and consumers.

D

Pipeline Execution

Event-driven, deterministic pipelines with bounded latency. Data is structured and prepared before downstream systems consume it-triggered by state changes, not arbitrary polling intervals. Events are delivered in a consistent, deterministic sequence within local pipeline execution paths. Behavior is reproducible and auditable.

E

Buffering & Reliability

Durable local buffering maintains data continuity during network interruptions. Data is persisted before acknowledgment. On reconnection, buffered data replays in order with original timestamps preserved. Delivery guarantees are a function of the buffering and replay mechanism, not external SLAs.

F

Extensibility (Module Control Plane)

External modules communicate with the core runtime over typed, versioned interfaces. Each module has independent lifecycle: deploy, start, stop, update, and remove without affecting other components. OEMs and developers extend the data plane with new protocol adapters, transforms, or connectors-without modifying core code.

G

SDK for Extensibility

The SDK enables developers to extend the data plane to any system-building custom source adapters, destination connectors, and processing modules that integrate natively with the runtime. Partners and OEMs use the SDK to embed KŌJŌ Stack capabilities into their own products. The SDK is the extensibility layer of the data plane.

H

Co-Located Edge Execution

Workloads execute alongside data pipelines in a shared runtime, ensuring processing occurs where data is acquired and structured. AI inference, protocol adapters, analytics engines, and custom logic operate as managed workloads with lifecycle control, health checks, and secret injection-co-located with the data plane at the edge.

I

Observability

Per-pipeline throughput, latency (p50/p95/p99), error rates, and backpressure metrics. Module health monitoring with connection status, buffer depth, and protocol diagnostics. Hash-chained audit trail for compliance. Operational control requires operational visibility.

J

API-First Control

120+ REST API endpoints with OpenAPI 3.0 specification and interactive Swagger UI. Every platform capability - sources, pipelines, destinations, modules, workloads, secrets, certificates - is API-accessible. Designed for automation, CI/CD pipelines, and infrastructure-as-code workflows.

K

Fleet Management

Centralized deployment, orchestration, and monitoring of all edge nodes across sites, regions, and environments. Push configuration updates, namespace models, and pipeline definitions with controlled rollout. Aggregate telemetry and health across the entire fleet from a single control interface.

L

AI Agent Integration (MCP Server)

A fleet-aware MCP (Model Context Protocol) server deployed at the edge enables AI agents to discover, query, and diagnose edge deployments. OAuth 2.0 identity with three-axis scoping, 22 read-only tools, and team-level isolation - designed for safe autonomous operation across distributed edge infrastructure.

Right Side of the Boundary

Downstream Systems: Where Data Is Consumed

Cloud platforms, historians, data lakes, AI/ML systems, and enterprise applications depend on structured, reliable data produced by the first-mile data plane. KŌJŌ Stack determines what data these systems receive-and in what form.

S3 Tables / Iceberg

Lakehouse with time travel

Apache Kafka

Event streaming, SASL/TLS

TimescaleDB

Time-series historian

MQTT Brokers

Cloud IoT, QoS 0/1/2

AWS IoT Core

X.509 certificate auth

S3 Data Lake

JSONL/CSV/Parquet batch export

Google Cloud Storage

JSONL/CSV/Parquet, BigQuery compatible

InfluxDB

Time-series historian, Line Protocol

The result: every downstream system receives data that is already structured, contextualized, and quality-annotated. No ETL pipelines to reconstruct meaning. No data quality issues to debug. No protocol-specific logic in analytics code.

How Data Moves

Data is not piped-it is shaped

KŌJŌ Stack does not passively transport data from source to destination. It actively determines what data exists downstream by ingesting, structuring, processing, and distributing it. Data is structured and prepared before downstream systems consume it.

1

Ingested

Protocol-native acquisition from OT systems

2

Structured

ISA-95 contextualization and schema normalization

3

Processed

CEL transforms, RBE filtering, quality annotation

4

Distributed

Buffered, reliable delivery to every destination

KŌJŌ Stack determines what data exists downstream.

No downstream system sees data that the data plane has not explicitly acquired, structured, and routed. This is first-mile data ownership.

Architectural Position

Where data is shaped determines how data behaves

KŌJŌ Stack does not sit beside existing systems-it sits between them. Every system above this boundary receives data that has been explicitly acquired, structured, and prepared. Every system below it remains unchanged.

The architecture is the product.

One deployment boundary. One data plane. One place where industrial data is acquired, structured, and prepared before it enters the digital world.